HPE Telco Service Orchestrator SQL Injection Vulnerability
Vulnerability
A SQL injection vulnerability has been identified in HPE Telco Service Orchestrator software versions prior to 5.2.1. This vulnerability allows authenticated clients to manipulate SQL queries when sending service requests, potentially exfiltrating the database's vendor name to unauthorized authenticated clients.
Impact
Exploitation of this vulnerability could lead to unauthorized access to the application database, allowing for SQL injection attacks that could manipulate or exfiltrate database information.
Remediation
Users can upgrade to HPE Telco Service Orchestrator version 5.2.1 or later to address this vulnerability. The update is available for download through the HPE My Enterprise License portal.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.